FEP Role - Confidence Boost Needed

[hypercube33]

So my situation is that I have clients install on every machine in our domain. I will be enabling the Endpoint Protection Role.

 

From my tests, reading, and lab experiments the following will keep me from "accidentally" rolling FEP out to everyone.

 

1. Install EP Role on SCCM

2. Enable management but set install to FALSE in the default Policy

3. Setup a new policy to manage deployment for groups of users in a controlled way.

4. I can also do a backwards, package install so FEP is available, ready to go before the user even logs into the machine by creating a package for FEP, and running as follows: scepinstall.exe /s /q as a package, and deploying in the task sequence

 

I'm 90% confident that nothing bad will happen, but I would love confidence increased before I fire away in production

 

-Brian

[anyweb]

my comments in RED below:-

 

1. Install EP Role on SCCM - you must do this on the Top most site server (CAS or a Primary in the case of a standalone primary)

2. Enable management but set install to FALSE in the default Policy, do NOT change the default client device settings, create Custom client device settings and deploy them to the collections you want targetted.

3. Setup a new policy to manage deployment for groups of users in a controlled way. you can only deploy Endpoint Protection to Computers, not users.

4. I can also do a backwards, package install so FEP is available, ready to go before the user even logs into the machine by creating a package for FEP, and running as follows: scepinstall.exe /s /q as a package, and deploying in the task sequence not following your train of thought here..

 

 

you havn't mentioned how you've defined your SUP, your ADR's for definition updates ? i would test everything in a lab first (use my guides) and then when you have confidence push it out to production starting one collection at a time. (phased rollout)

[hypercube33]

This is welcomed, and clears up any false perceptions I may have had. Thanks -- always the best source of information. Write some books already

 

As for this:

 

4. I can also do a backwards, package install so FEP is available, ready to go before the user even logs into the machine by creating a package for FEP, and running as follows: scepinstall.exe /s /q as a package, and deploying in the task sequence not following your train of thought here.

 

Whilst deploying Windows 7 via a task sequence, my supervisor wants the machine protected as soon as possible. Without running tests to see if it enables the Endpoint Protection during the "Install CM Client" task sequence or soon therafter:

 

Would I want to manually deploy the EP2012 Client during a System Deployment Task Sequence to get the system protected before anything else occurs on our network?